Six (6) months after its takedown in Operation Endgame, the DanaBot malware has reemerged with version 669, featuring a rebuilt command-and-control (C2) infrastructure leveraging Tor domains and “backconnect” nodes. Researchers at Zscaler ThreatLabz report that threat actors are now using multiple cryptocurrency wallets in BTC, ETH, LTC, and TRX to collect stolen funds. Originally discovered by Proofpoint as a Delphi-based banking trojan operating under a malware-as-a-service (MaaS) model, DanaBot has evolved into a modular infostealer and loader capable of harvesting credentials and crypto wallet data from browsers. Despite law enforcement’s global disruption in May, the malware’s operators have rebuilt the network, spotlighting the resilience of cybercriminals when key actors remain operational. DanaBot continues to spread via phishing emails, SEO poisoning, and malvertising campaigns that can lead to ransomware infections. CTIX analysts advise organizations to follow Zscaler’s guidance to apply updated indicators of compromise (IoCs) and enhance endpoint defenses to mitigate renewed DanaBot activity.